https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 20:01:48 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-335494 EUVD-2026-335494 https://cve.radiocsirt.org/vuln/euvd-2026-335494 https://cve.radiocsirt.org/vuln/fkie_cve-2026-54004 <p>Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites with content.fileRedirects enabled could redirect unauthenticated clean file URL requests for files stored in top-level draft pages to physical media URLs without checking page access permissions or preview tokens, leading to disclosure of draft file contents. This issue is fixed in versions 4.9.4 and 5.4.4.</p> <p>Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites with content.fileRedirects enabled could redirect unauthenticated clean file URL requests for files stored in top-level draft pages to physical media URLs without checking page access permissions or preview tokens, leading to disclosure of draft file contents. This issue is fixed in versions 4.9.4 and 5.4.4.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-54004 https://cve.radiocsirt.org/vuln/ghsa-89cp-7p28-jffg <p><strong>Affected:</strong> Packagist: getkirby/cms</p> <p>### TL;DR</p> <p>This vulnerability affects Kirby 5 sites that have the `content.fileRedirects` option enabled (set to `true` or a custom closure) as well as all Kirby 4 sites that haven&#39;t explicitly disabled this option.</p> <p>It was possible to access clean file URLs of top-level drafts (e.g. `/about-us/team.jpg`) without providing authentication, without being authorized to access the top-level draft page, and without providing a valid preview token.</p> <p>Sites on Kirby 5 using the default configuration are *not* affected by this vulnerability (the `content.fileRedirects` option is disabled by default since Kirby 5.0.0). It was also *not* possible to maliciously access clean file URLs for files stored in page drafts that are not on the top-level (such as `/blog/article/resource.pdf`).</p> <p>----</p> <p>### Introduction</p> <p>Missing authorization allows authenticated users to perform actions they are not intended to have access to.</p> <p>The effects of missing authorization can include unauthorized access to sensitive information as well as unauthorized changes to content or system information.</p> <p>### Affected components</p> <p>Clean file redirects allow visitors to access files stored in the content folder via natural URLs such as `/about-us/team.jpg` or `/blog/article/resource.pdf`. Kirby detects such requests and redirects them to the actual physical file URLs in the `media` folder.</p> <p>Kirby 4.8.0 introduced the `content.fileRedirects` option that allowed disabling this behavior to protect against third-party acce…</p> <p><strong>Affected:</strong> Packagist: getkirby/cms</p> <p>### TL;DR</p> <p>This vulnerability affects Kirby 5 sites that have the `content.fileRedirects` option enabled (set to `true` or a custom closure) as well as all Kirby 4 sites that haven&#39;t explicitly disabled this option.</p> <p>It was possible to access clean file URLs of top-level drafts (e.g. `/about-us/team.jpg`) without providing authentication, without being authorized to access the top-level draft page, and without providing a valid preview token.</p> <p>Sites on Kirby 5 using the default configuration are *not* affected by this vulnerability (the `content.fileRedirects` option is disabled by default since Kirby 5.0.0). It was also *not* possible to maliciously access clean file URLs for files stored in page drafts that are not on the top-level (such as `/blog/article/resource.pdf`).</p> <p>----</p> <p>### Introduction</p> <p>Missing authorization allows authenticated users to perform actions they are not intended to have access to.</p> <p>The effects of missing authorization can include unauthorized access to sensitive information as well as unauthorized changes to content or system information.</p> <p>### Affected components</p> <p>Clean file redirects allow visitors to access files stored in the content folder via natural URLs such as `/about-us/team.jpg` or `/blog/article/resource.pdf`. Kirby detects such requests and redirects them to the actual physical file URLs in the `media` folder.</p> <p>Kirby 4.8.0 introduced the `content.fileRedirects` option that allowed disabling this behavior to protect against third-party acce…</p> https://cve.radiocsirt.org/vuln/ghsa-89cp-7p28-jffg